From 106a0cb6fd5669ee0e753a29d65955c8dd760ada Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 18 Jul 2018 22:35:13 +0100 Subject: [PATCH] Rework the array_of_pointers utility function. It now makes use of the original array's symbol table to get the pointer template, such that the size of the pointer is correct according to the original table. Resolves "pointer.size" attribute errors (firing inside a property and thus throwing off unusual exceptions). --- volatility/framework/objects/utility.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility/framework/objects/utility.py b/volatility/framework/objects/utility.py index e3fb3c3fc..58c5027b6 100644 --- a/volatility/framework/objects/utility.py +++ b/volatility/framework/objects/utility.py @@ -1,7 +1,7 @@ import datetime import typing -from volatility.framework import interfaces, objects, renderers +from volatility.framework import interfaces, objects, renderers, constants def array_to_string(array: objects.Array, @@ -33,11 +33,13 @@ def array_of_pointers(array: interfaces.objects.ObjectInterface, subtype: typing.Optional[typing.Union[str, interfaces.objects.Template]] = None, context: interfaces.context.ContextInterface = None) -> interfaces.objects.ObjectInterface: """Takes an object, and recasts it as an array of pointers to subtype""" + symbol_table = array.vol.type_name.split(constants.BANG)[0] if isinstance(subtype, str) and context is not None: subtype = context.symbol_space.get_type(subtype) if not isinstance(subtype, interfaces.objects.Template) or subtype is None: raise TypeError("Subtype must be a valid template (or string name of an object template)") - subtype_pointer = objects.templates.ObjectTemplate(objects.Pointer, type_name = 'pointer', subtype = subtype) + subtype_pointer = context.symbol_space.get_type(symbol_table + constants.BANG + "pointer") + subtype_pointer.update_vol(subtype = subtype) return array.cast("array", count = count, subtype = subtype_pointer)